1. Field of the Invention
The invention relates to a method and to an apparatus which is adapted for carrying out the method, for single-channel bus coupling of safety-relevant processes.
2. Description of the Related Art
In the following text, the expression “a safety-relevant process” means a process which does not result in more than a negligible risk to people and/or to material goods either when a fault occurs. In a safety-relevant process, it is therefore necessary to ensure with 100% confidence in the ideal case that, when a fault is present, this process, a subsequent process that is coupled to this process, and/or an overall system which includes this process are/is brought to a safe state. Safety-relevant processes such as these may thus also be process elements of larger, higher-level overall processes. Examples of safety-relevant processes are chemical processes in which it is essential that critical processes be kept in a predetermined range, complex machine control systems, for example for a hydraulic press or a production line, in which case, by way of example, the starting up of a pressing/cutting tool may repesent a safety-relevant process element. Further examples of safety-relevant processes (process elements) are the monitoring of protective guards, protective doors or light areas, the control of two-handed-operation switches or else the reaction to emergency off switches.
It is thus absolutely essential for all safety-relevant processes that the respectively associated safety-relevant data that is produced, recorded or measured is transported in real time without any corruption, since any corruption can result in an incorrect operation and/or reaction which, in the end, may endanger people's lives and health.
In order to comply with the safety regulations, numerous agreements have been reached in recent years, which require virtually error-free data transport when using bus systems. These relate in particular to the data transport itself and to a permissible residual error probability as a function of the respective application and/or of the respective process. Relevant standards which may be quoted in this case include, in particular, EN 61508 and EN 954-1, as well as the principles for testing and certification of “bus systems for the transmission of safety-relevant messages” produced by Test and Certification Center of the German Industrial Professional Societies.
Safety-based bus systems have been developed in accordance with these agreements and standards, which transmit data with high redundancy. Possible faults or errors are discovered in good time, and any risk can be avoided. Examples of this include, inter alia, the Safety Bus P, Profibus F, Interbus Safety etc.
However, one disadvantage in this case is that already installed bus systems must be replaced for the use of safety-based bus systems, and it is frequently necessary to accept restrictions to the number of subscribers, to the data transport rate or to the data protocol.
In consequence, safety-based methods and/or components have been developed which allow simpler and lower-cost retrofitting of already existing bus systems. The (field) bus systems which are already used between the individual units involved in a process are in this case used for data communication for transmission of safety-relevant data, in particular between sensors, actuators and/or control devices, particularly in the case of electronic safety methods which are used for control and automation technology.
By way of example, EP 1 188 096 B1 discloses a control system for a safety-relevant process with a field bus via which a control unit for controlling the safety-relevant process and a signal unit which is linked via I/O channels to the safety-relevant process are connected. In order to ensure failsafe communication with one another, these units have safety-related devices whose aim 1s to make units that are not safe become safe units. In detail, at least two redundant processing channels are in each case provided in such a way that an error or fault in one of the processing channels can be identified and possibly corrected on the basis of a result which differs from that of another of the redundant processing channels. This multiple channel structure is provided in particular by two redundant computers, with the safety analysis ending after the two redundant computers and the analysis being used for a safe data protocol from this point, without any further statements.
In the following text, the general word computer essentially means any type of data processing devices such as microcomputers, microprocessors, microcontrollers or else PCs.
WO 01/24385 A2 also relates to the control of safety-relevant processes using (field) bus systems, with the units which are involved in the control of the safety-relevant process once again generally having redundant processing channels. Each of the redundant channels has a computer, and the computers monitor one another. This multiple channel structure is changed to a single-channel structure by means of a further computer which is connected to the field bus (FIG. 3). The document does not contain any more far-reaching statements, including the change from the multiple channel form to the single-channel form.
WO 01/24391 A1 and the Laid-Open Specification DE 199 39 567 A1 are further examples of safe bus subscribers with redundant processing channels which monitor one another for safe protocol creation, and/or computers and a subsequent change from the two-channel form to the single-channel form via a further computer which is coupled to the bus and is connected to a protocol chip or is integrated in it. In this case as well, the safety analysis ends without the disclosure of further technical measures based on the two redundant computers, and the analysis for a safe data protocol comes into play from this point.
Patent Specification DE 195 32 639 C2, which relates to a device for single-channel transmission of data formed by two redundant computers, integrates the function of bus coupling into one of the two redundant computers in order to reduce the circuit complexity. Only that computer which has the bus coupling functionality thus has an output channel, to which useful data originating from this computer and test data originating from the other computer are supplied, or vice versa, or useful data and test data from both computers are supplied, interleaved in one another (FIG. 4). However, in order to ensure that the computer which is controlling the bus is not able to produce messages which the other computer cannot influence, the implementation of the safety analysis involves increased complexity since, on the one hand, the freedom from reactions and on the other hand the independence of the computers for creation of the safe protocol must be verified. In this context, the patent specification proposes only appropriate connection and non-connection of the respective computer outputs.
Furthermore, DE 100 65 907 A1 describes a method, based on the principle of “redundancy with cross-over comparison” for safe data transport for data transmission on parallel or series networks or bus systems, using a buffer register with two logically identical data areas for changing from the two-channel form to the single-channel form. The complete, safety-based message to be transmitted on one channel via the bus system includes the data contents of both data areas of the buffer register. Two redundant computers are once again connected upstream of the buffer register at the transmitter end and, depending on the nature of the application, in each case preprocess safety-relevant data (which is made available on one channel or two channels) with redundant information to form safe data, which they interchange with one another for checking. If both come to the same result, each of the computers transfers its safe data to the buffer register, with each data area being filled with the safe data from in each case one computer, which data itself already contains redundant information for error or fault identification. If, in an alternative embodiment, the buffer register is contained in one of the two computers, such that this one computer in consequence appropriately fills both data areas of the buffer register after agreement with the second computer, this second computer reads out the buffer register with the two data areas once again, for monitoring. Depending on the application, the data content of one of the two data areas of the buffer register may also have inverted data or other additional interleaving in order, for example, to identify systematic faults in the transmitters, receivers and/or other units which pass on the data. This therefore has the particular disadvantage that the overall data length of the safety-based message is extremely large with respect to the actual useful data, and the data transmission rate for the actual useful data is thus low, since two identical useful data records as well as a respective redundant item of information for each of the identical useful data records has to be transmitted. If the number of useful data items to be transmitted per data packet decreases, as is the case by way of example with the Interbus, the ratio of the useful data length to the overall data length decreases to a greater extent.